Bug 247874
| Summary: | [Wasm-GC] Fix refcounts for compound type definitions | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Asumu Takikawa <asumu> |
| Component: | WebAssembly | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | |||
| Bug Blocks: | 247394 | ||
Asumu Takikawa
Currently the `JSTests/wasm/gc/sub.js` test suite can fail under certain conditions, e.g., running in continuous-collect mode. When running with ASAN, it reports a "heap-use-after-free" error.
The problem is likely due to how refcounts are tracked for compound type definitions such as recursion groups and subtypes. For simple type definitions such as functions, structs, and arrays, the type signature list in a module holds RefPtrs to all the types. Compound types hold other types and must keep them live as well, in addition to the reference tracked by the module. This should just require some additional `ref/deref` at appropriate places (I'm not sure there is a good way to abstract this using Ref/RefPtr due to how type definitions are represented).
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Asumu Takikawa
Pull request: https://github.com/WebKit/WebKit/pull/6527
EWS
Committed 256800@main (febd6818b5b7): <https://commits.webkit.org/256800@main>
Reviewed commits have been landed. Closing PR #6527 and removing active labels.
Radar WebKit Bug Importer
<rdar://problem/102480670>